Comment by dcow

Unless you truly want to uphold the property "the something I have is not the something that stores my passwords" (you likely don't), your two factor codes should be in your password manager. Period. A good password manager has a strong user/device PKI backed by an offline key and will only be accessible on devices you've bootstrapped, so it's isomorphic to "something I have" at least and usually exactly equal to "somethings I have". And if you are a security nut trying to uphold that property and telling people it's bad to put your TOTP urls in your password manager... you better not have an authenticator app installed on the same device as your password manager or you've thrown that property out the window. Not saying it's never appropriate to have a true second factor. Just that it's not appropriate for 99% of consumer use cases and the security setup and structure afforded by password managers is more than sufficient to have good account hygiene. It would be a better world if everyone used a password manager and stored their totp codes in it than everyone has a hodgepodge of authentication apps that aren't reliable and break and cause services to implement manual verification backdoor loopholes into their auth anyway etc. etc. TOTP 2FA defends against weak passwords. A password manager enables strong passwords largely making TOTP irrelevant. Unfortunately not everyone uses a password manager and thus services are compelled to add TOTP 2FA because what other choice do they have?